DockTail

DockTail is a Docker and Tailscale networking tool for people who want to publish containerized applications to their tailnet without giving every container its own Tailscale device identity. It reads docktail.* Docker labels, watches Docker events, and advertises matching containers as native Tailscale Services from a tagged host.

Instead of configuring a separate Tailscale identity for every application or publishing individual container ports, DockTail routes directly to container IPs on the Docker network. Containers can appear in Tailscale within seconds of starting, while users access them through service names rather than separate device identities.

Key Features

Label-Based Configuration

Configure which containers DockTail should advertise directly through Docker labels.

The label-driven workflow lets you:

• Enable DockTail for a container
• Set its Tailscale service name
• Define the backend port
• Keep configuration alongside the container definition

This works naturally with Docker Compose and similar container-based workflows.

Native Tailscale Services

DockTail publishes applications as Tailscale Services rather than creating a separate Tailscale device for every container.

This keeps the networking model focused on the services you actually want to expose while allowing the containers to retain their existing Docker lifecycle.

Direct Container IP Proxying

DockTail routes traffic directly to container IP addresses on the Docker network.

This means you can expose a container through Tailscale without separately publishing its port to the host.

• No per-app port publishing
• Direct Docker-network routing
• Existing container networking remains intact
• Access through the advertised service name

Docker Event Reconciliation

DockTail watches Docker events and keeps its advertised services aligned with the containers that are actually running.

When containers are started or changed, DockTail can reconcile the service configuration so the Tailscale view stays synchronized with the Docker environment.

Containers can appear in Tailscale within seconds after they are started.

Tailscale Funnel Support

DockTail can also expose matching containers to the public internet through Tailscale Funnel.

The same label-driven configuration approach can be used when a container needs to move beyond private tailnet access.

Built For Docker And Tailscale Users

DockTail is designed for self-hosted stacks, Docker Compose environments, and container fleets that already use Tailscale and want a lightweight way to expose internal services.

It is useful for both small deployments and larger container environments where creating a separate network identity for every application would add unnecessary configuration.

Common Use Cases

Self-Hosted Applications

Expose internal Docker applications to trusted users on your tailnet without publishing individual application ports.

Docker Compose Stacks

Keep Tailscale service configuration alongside Docker Compose definitions using docktail.* labels.

Container Fleets

Automatically keep advertised services aligned as containers are started, stopped, or changed.

Minimal Per-App Networking

Avoid restructuring applications around separate Tailscale devices while preserving their existing Docker lifecycle.

Public Container Access

Use Tailscale Funnel to expose selected containers publicly using the same label-based approach.

Service Advertising Instead Of Sidecars

DockTail's model is closer to service advertising than sidecar management. The container remains a normal Docker workload, while DockTail handles how the selected service is represented within Tailscale.

That distinction helps keep per-application configuration lightweight. You do not need to give every application its own Tailscale device identity just to make it reachable through the tailnet.

DockTail Cloud

DockTail Cloud adds monitoring around the Docker and Tailscale setup.

It watches:

• Hosts
• Containers
• Local reachability
• Tailnet exposure

It also records the type of failure that occurred, helping distinguish between different layers of the stack.

For example, a problem can be easier to identify as an application issue, Docker issue, or service exposure issue rather than treating every connectivity failure as the same problem.

Why It Matters

Running Docker applications behind Tailscale can become unnecessarily complicated when every container is treated as a separate network identity or requires its own published port.

DockTail takes a service-oriented approach. Containers remain part of the existing Docker environment while selected applications are advertised as native Tailscale Services from a tagged host.

The result is a lightweight workflow: add labels, start the container, let DockTail reconcile it, and access the service through Tailscale.

Connect Docker Services To Tailscale With DockTail

Publish Docker containers as native Tailscale Services without giving every application its own device identity. With label-based configuration, direct container IP routing, Docker event reconciliation, and optional Funnel support, DockTail provides a simpler way to connect existing container stacks to your tailnet.